;;; starttls.el --- STARTTLS functions;; Copyright (C) 1999, 2000, 2002, 2003, 2004,;; 2005 Free Software Foundation, Inc.;; Author: Daiki Ueno <ueno@unixuser.org>;; Author: Simon Josefsson <simon@josefsson.org>;; Created: 1999/11/20;; Keywords: TLS, SSL, OpenSSL, GNUTLS, mail, news;; This file is part of XEmacs.;; XEmacs is free software; you can redistribute it and/or modify;; it under the terms of the GNU General Public License as published by;; the Free Software Foundation; either version 2, or (at your option);; any later version.;; XEmacs is distributed in the hope that it will be useful,;; but WITHOUT ANY WARRANTY; without even the implied warranty of;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the;; GNU General Public License for more details.;; You should have received a copy of the GNU General Public License;; along with XEmacs; see the file COPYING. If not, write to the;; Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,;; Boston, MA 02110-1301, USA.;;; Commentary:;; This module defines some utility functions for STARTTLS profiles.;; [RFC 2595] "Using TLS with IMAP, POP3 and ACAP";; by Chris Newman <chris.newman@innosoft.com> (1999/06);; This file now contain a combination of the two previous;; implementations both called "starttls.el". The first one is Daiki;; Ueno's starttls.el which uses his own "starttls" command line tool,;; and the second one is Simon Josefsson's starttls.el which uses;; "gnutls-cli" from GNUTLS.;;;; If "starttls" is available, it is prefered by the code over;; "gnutls-cli", for backwards compatibility. Use;; `starttls-use-gnutls' to toggle between implementations if you have;; both tools installed. It is recommended to use GNUTLS, though, as;; it performs more verification of the certificates.;; The GNUTLS support require GNUTLS 0.9.90 (released 2003-10-08) or;; later, from <http://www.gnu.org/software/gnutls/>, or "starttls";; from <ftp://ftp.opaopa.org/pub/elisp/>.;; Usage is similar to `open-network-stream'. For example:;;;; (when (setq tmp (starttls-open-stream;; "test" (current-buffer) "yxa.extundo.com" 25));; (accept-process-output tmp 15);; (process-send-string tmp "STARTTLS\n");; (accept-process-output tmp 15);; (message "STARTTLS output:\n%s" (starttls-negotiate tmp));; (process-send-string tmp "EHLO foo\n"));; An example run yield the following output:;;;; 220 yxa.extundo.com ESMTP Sendmail 8.12.11/8.12.11/Debian-3; Wed, 26 May 2004 19:12:29 +0200; (No UCE/UBE) logging access from: c494102a.s-bi.bostream.se(OK)-c494102a.s-bi.bostream.se [217.215.27.65];; 220 2.0.0 Ready to start TLS;; 250-yxa.extundo.com Hello c494102a.s-bi.bostream.se [217.215.27.65], pleased to meet you;; 250-ENHANCEDSTATUSCODES;; 250-PIPELINING;; 250-EXPN;; 250-VERB;; 250-8BITMIME;; 250-SIZE;; 250-DSN;; 250-ETRN;; 250-AUTH DIGEST-MD5 CRAM-MD5 PLAIN LOGIN;; 250-DELIVERBY;; 250 HELP;; nil;;;; With the message buffer containing:;;;; STARTTLS output:;; *** Starting TLS handshake;; - Server's trusted authorities:;; [0]: C=SE,ST=Stockholm,L=Stockholm,O=YXA,OU=CA,CN=yxa.extundo.com,EMAIL=staff@yxa.extundo.com;; - Certificate type: X.509;; - Got a certificate list of 2 certificates.;;;; - Certificate[0] info:;; # The hostname in the certificate matches 'yxa.extundo.com'.;; # valid since: Wed May 26 12:16:00 CEST 2004;; # expires at: Wed Jul 26 12:16:00 CEST 2023;; # serial number: 04;; # fingerprint: 7c 04 4b c1 fa 26 9b 5d 90 22 52 3c 65 3d 85 3a;; # version: #1;; # public key algorithm: RSA;; # Modulus: 1024 bits;; # Subject's DN: C=SE,ST=Stockholm,L=Stockholm,O=YXA,OU=Mail server,CN=yxa.extundo.com,EMAIL=staff@yxa.extundo.com;; # Issuer's DN: C=SE,ST=Stockholm,L=Stockholm,O=YXA,OU=CA,CN=yxa.extundo.com,EMAIL=staff@yxa.extundo.com;;;; - Certificate[1] info:;; # valid since: Sun May 23 11:35:00 CEST 2004;; # expires at: Sun Jul 23 11:35:00 CEST 2023;; # serial number: 00;; # fingerprint: fc 76 d8 63 1a c9 0b 3b fa 40 fe ed 47 7a 58 ae;; # version: #3;; # public key algorithm: RSA;; # Modulus: 1024 bits;; # Subject's DN: C=SE,ST=Stockholm,L=Stockholm,O=YXA,OU=CA,CN=yxa.extundo.com,EMAIL=staff@yxa.extundo.com;; # Issuer's DN: C=SE,ST=Stockholm,L=Stockholm,O=YXA,OU=CA,CN=yxa.extundo.com,EMAIL=staff@yxa.extundo.com;;;; - Peer's certificate issuer is unknown;; - Peer's certificate is NOT trusted;; - Version: TLS 1.0;; - Key Exchange: RSA;; - Cipher: ARCFOUR 128;; - MAC: SHA;; - Compression: NULL;;; Code:(defgroupstarttlsnil"Support for `Transport Layer Security' protocol.":version"21.1":group'mail)(defcustomstarttls-gnutls-program"gnutls-cli""Name of GNUTLS command line tool.This program is used when GNUTLS is used, i.e. when`starttls-use-gnutls' is non-nil.":type'string:group'starttls)(defcustomstarttls-program"starttls""The program to run in a subprocess to open an TLSv1 connection.This program is used when the `starttls' command is used,i.e. when `starttls-use-gnutls' is nil.":type'string:group'starttls)(defcustomstarttls-use-gnutls(not(executable-findstarttls-program))"*Whether to use GNUTLS instead of the `starttls' command.":type'boolean:group'starttls)(defcustomstarttls-extra-argsnil"Extra arguments to `starttls-program'.This program is used when the `starttls' command is used,i.e. when `starttls-use-gnutls' is nil.":type'(repeatstring):group'starttls)(defcustomstarttls-extra-argumentsnil"Extra arguments to `starttls-program'.This program is used when GNUTLS is used, i.e. when`starttls-use-gnutls' is non-nil.For example, non-TLS compliant servers may require'(\"--protocols\" \"ssl3\"). Invoke \"gnutls-cli --help\" tofind out which parameters are available.":type'(repeatstring):group'starttls)(defcustomstarttls-process-connection-typenil"*Value for `process-connection-type' to use when starting STARTTLS process.":type'boolean:group'starttls)(defcustomstarttls-connect"- Simple Client Mode:\n\n""*Regular expression indicating successful connection.The default is what GNUTLS's \"gnutls-cli\" outputs.";; GNUTLS cli.c:main() print this string when it is starting to run;; in the application read/write phase. If the logic, or the string;; itself, is modified, this must be updated.:type'regexp:group'starttls)(defcustomstarttls-failure"\\*\\*\\* Handshake has failed""*Regular expression indicating failed TLS handshake.The default is what GNUTLS's \"gnutls-cli\" outputs.";; GNUTLS cli.c:do_handshake() print this string on failure. If the;; logic, or the string itself, is modified, this must be updated.:type'regexp:group'starttls)(defcustomstarttls-success"- Compression: ""*Regular expression indicating completed TLS handshakes.The default is what GNUTLS's \"gnutls-cli\" outputs.";; GNUTLS cli.c:do_handshake() calls, on success,;; common.c:print_info(), that unconditionally print this string;; last. If that logic, or the string itself, is modified, this;; must be updated.:type'regexp:group'starttls)(defunstarttls-negotiate-gnutls(process)"Negotiate TLS on process opened by `open-starttls-stream'.This should typically only be done once. It typically return amulti-line informational message with information about thehandshake, or NIL on failure."(let(bufferinfoold-maxdone-okdone-bad)(if(null(setqbuffer(process-bufferprocess)));; XXX How to remove/extract the TLS negotiation junk?(signal-process(process-idprocess)'SIGALRM)(with-current-bufferbuffer(save-excursion(setqold-max(goto-char(point-max)))(signal-process(process-idprocess)'SIGALRM)(while(and(processpprocess)(eq(process-statusprocess)'run)(save-excursion(goto-charold-max)(not(or(setqdone-ok(re-search-forwardstarttls-successnilt))(setqdone-bad(re-search-forwardstarttls-failurenilt))))))(accept-process-outputprocess1100)(sit-for0.1))(setqinfo(buffer-substring-no-propertiesold-max(point-max)))(delete-regionold-max(point-max))(if(or(anddone-ok(notdone-bad));; Prevent mitm that fake success msg after failure msg.(anddone-okdone-bad(<done-okdone-bad)))info(message"STARTTLS negotiation failed: %s"info)nil))))))(defunstarttls-negotiate(process)(ifstarttls-use-gnutls(starttls-negotiate-gnutlsprocess)(signal-process(process-idprocess)'SIGALRM)))(eval-and-compile(if(fboundp'set-process-query-on-exit-flag)(defalias'starttls-set-process-query-on-exit-flag'set-process-query-on-exit-flag)(defalias'starttls-set-process-query-on-exit-flag'process-kill-without-query)))(defunstarttls-open-stream-gnutls(namebufferhostservice)(message"Opening STARTTLS connection to `%s'..."host)(let*(done(old-max(with-current-bufferbuffer(point-max)))(process-connection-typestarttls-process-connection-type)(process(apply#'start-processnamebufferstarttls-gnutls-program"-s"host"-p"(if(integerpservice)(int-to-stringservice)service)starttls-extra-arguments)))(starttls-set-process-query-on-exit-flagprocessnil)(while(and(processpprocess)(eq(process-statusprocess)'run)(save-excursion(set-bufferbuffer)(goto-charold-max)(not(setqdone(re-search-forwardstarttls-connectnilt)))))(accept-process-outputprocess0100)(sit-for0.1))(ifdone(with-current-bufferbuffer(delete-regionold-maxdone))(delete-processprocess)(setqprocessnil))(message"Opening STARTTLS connection to `%s'...%s"host(ifdone"done""failed"))process))(defunstarttls-open-stream(namebufferhostservice)"Open a TLS connection for a service to a host.Returns a subprocess-object to represent the connection.Input and output work as for subprocesses; `delete-process' closes it.Args are NAME BUFFER HOST SERVICE.NAME is name for process. It is modified if necessary to make it unique.BUFFER is the buffer (or `buffer-name') to associate with the process. Process output goes at end of that buffer, unless you specify an output stream or filter function to handle the output. BUFFER may be also nil, meaning that this process is not associated with any bufferThird arg is name of the host to connect to, or its IP address.Fourth arg SERVICE is name of the service desired, or an integerspecifying a port number to connect to."(ifstarttls-use-gnutls(starttls-open-stream-gnutlsnamebufferhostservice)(let*((process-connection-typestarttls-process-connection-type)(process(apply#'start-processnamebufferstarttls-programhost(format"%s"service)starttls-extra-args)))(starttls-set-process-query-on-exit-flagprocessnil)process)))(provide'starttls);;; arch-tag: 648b3bd8-63bd-47f5-904c-7c819aea2297;;; starttls.el ends here